> ## Documentation Index > Fetch the complete documentation index at: https://developer.lofty.com/llms.txt > Use this file to discover all available pages before exploring further. # Overview > Connect AI agents and LLM-based tools to the Lofty CRM API over the Model Context Protocol, using four tools that cover every endpoint. The Lofty MCP server exposes the same [Lofty Developer API](/introduction) documented on this site to any [Model Context Protocol](https://modelcontextprotocol.io) client — Claude, or any other MCP-compatible agent — so it can search for the right operation, inspect its parameters, and call it. There's no generated SDK and nothing to install; you point your MCP client at one URL. ## Why four tools instead of one per endpoint The API has **123 operations** — the same coverage as the [API Reference](/api-reference/leads/overview) on this site: leads, notes, tasks, transactions, communication, calendar, webhooks, and team/routing configuration. Exposing each one as its own MCP tool would put every schema into the model's context on every turn, which measurably degrades tool selection as the list grows — and the list only grows over time. Instead, the MCP server exposes four tools that cover the entire API: 1. **`search_apis`** — find which operation matches an intent, by keyword. 2. **`describe_api`** — get the full parameter schema for one operation. 3. **`invoke_api`** — call it. 4. **`list_custom_fields`** — look up your team's custom lead fields, which aren't in any static schema. The trade-off is one extra round trip (search, then describe, then call) instead of a single tool call — worth it because the tool list never grows no matter how many endpoints the underlying API adds. ## Endpoint ``` https://mcp.lofty.com/mcp ``` The server speaks Streamable HTTP (JSON-RPC 2.0) and is **stateless** — no session affinity is required between requests, so it's safe to call from behind a load balancer or a serverless client. ## The four tools | Tool | Purpose | | --------------------------------------------------------------- | -------------------------------------------------------------------------------------- | | [`search_apis`](/mcp/tools-reference#search_apis) | Find operations matching a plain-language description of what you want to do. | | [`describe_api`](/mcp/tools-reference#describe_api) | Return one operation's full parameter schema, description, and whether it's read-only. | | [`invoke_api`](/mcp/tools-reference#invoke_api) | Execute one operation as the authenticated caller. | | [`list_custom_fields`](/mcp/tools-reference#list_custom_fields) | Return the caller's team's custom lead field definitions. | Every call runs through the same authentication, authorization, and rate limiting as a direct REST request — `invoke_api` can't do anything the authenticated user couldn't already do through the Lofty CRM itself. ## Security: this connects an agent to real, writable CRM data Unlike a read-only documentation server, `invoke_api` can create, update, and delete real records — leads, notes, tasks, transactions — as the authenticated user. Keep two risks in mind when wiring this up: * **Prompt injection.** Content read back through `invoke_api` (a lead's notes, a text message, a custom field value) is untrusted input from your CRM data, not from you — if an attacker can get text into a record your agent later reads, that text can attempt to redirect the agent's next action. Don't let an agent chain a read of CRM content directly into a write or delete without a human confirming the specific call, especially when other MCP servers or tools are connected in the same session. * **Destructive operations.** [`describe_api`](/mcp/tools-reference#describe_api) marks any operation that modifies or deletes data; treat that as a hard stop for confirmation, not a suggestion. ## Next steps Connect a client and make your first search → describe → invoke round trip. How API keys and OAuth 2.0 tokens both work over MCP. Full input schema and example calls for all four tools. Common errors and how to resolve them.